CVE-2026-9046

HIGH 7.0

CVSS Score

7.0

EPSS Score

0.0%

EPSS Percentile

0th

A potential insecure permissions vulnerability was reported in Legion Zone and the Lenovo App Store Windows applications, distributed exclusively in the Chinese market, that when installed on a non‑system partition, could allow a local user to execute arbitrary code.

CWE	CWE-277
Vendor	lenovo
Product	legion zone
Published	Jul 16, 2026

Stay Ahead of the Next One

Get instant alerts for lenovo legion zone

Be the first to know when new high vulnerabilities affecting lenovo legion zone are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Lenovo / Legion Zone

0 < 2.0.26

Lenovo / App Store

0 < 9.0.29

References

NVD ↗ CVE.org ↗ EPSS Data ↗

iknow.lenovo.com.cn: https://iknow.lenovo.com.cn/detail/441420

Credits

Lenovo thanks China Telecom Corporation Limited Research Institute (Zhang Daoquan, Deng Xiaodong, Wang Wenqun, Wang Yuqi) for reporting this issue.